- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 31 · 21 high, 9 medium, 1 low
- Registry
- Packagist
Advisories 31
- CVE-2026-86204High 7.1
PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket
Affected: fixed in 5.39.2.
- CVE-2026-86203Medium 6.3
PocketMine-MP before 5.39.2 Item Duplication via Despawn State
Affected: fixed in 5.39.2.
- CVE-2026-86202Medium 5.3
PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
Affected: fixed in 5.39.2.
- CVE-2026-86201High 8.7
PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
Affected: fixed in 5.41.1.
- CVE-2026-86200Medium 6.9
PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT
Affected: fixed in 5.42.1.
- CVE-2026-86198Low 2.3
PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
Affected: fixed in 5.44.2.
- CVE-2025-71418Medium 6.9
PocketMine-MP before 5.25.2 Denial of Service via explode
Affected: fixed in 5.25.2.
- CVE-2025-71417High 7.1
PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket
Affected: fixed in 5.32.1.
- CVE-2024-58381High 8.7
PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
Affected: fixed in 5.11.1.
- CVE-2024-58380High 7.1
PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket
Affected: fixed in 5.11.2.
- CVE-2023-54396High 7.1
PocketMine-MP before 4.8.1 Server Crash via Banner NBT
Affected: fixed in 4.8.1.
- CVE-2023-54395Medium 5.3
PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket
Affected: fixed in 4.12.5.
- CVE-2023-54394Medium 5.3
PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
Affected: fixed in 4.18.0-ALPHA2.
- CVE-2023-54393High 8.7
PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
Affected: fixed in 4.20.5; from 4.21.0, fixed in 4.21.1.
- CVE-2023-54392High 7.1
PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket
Affected: from 4.20.0, fixed in 4.22.3; from 5.0.0, fixed in 5.2.1.
Show all 31 advisoriesShow fewer advisories
- CVE-2023-54390High 8.7
PocketMine-MP before 5.3.1 Denial of Service via LoginPacket
Affected: from 5.0.0, fixed in 5.3.1; fixed in 4.23.1.
- CVE-2023-54355High 8.7
PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve
Affected: from 5.2.0, fixed in 5.3.1.
- CVE-2022-51018High 7.1
PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages
Affected: fixed in 3.26.5; from 4.0.0, fixed in 4.0.5.
- CVE-2022-51017High 8.7
PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
Affected: fixed in 3.26.5; from 4.0.0, fixed in 4.0.5.
- CVE-2022-51016Medium 5.3
PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay
Affected: from 3.0.0, fixed in 4.0.0.
- CVE-2022-51015High 7.1
PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
Affected: fixed in 4.0.6.
- CVE-2022-51014High 7.1
PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
Affected: from 4.0.0, fixed in 4.0.7.
- CVE-2022-51013High 7.1
PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
Affected: fixed in 4.2.4.
- CVE-2022-51012High 7.1
PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
Affected: fixed in 4.2.9.
- CVE-2022-51011Medium 5.3
PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
Affected: fixed in 4.2.10.
- CVE-2022-51010High 7.1
PocketMine-MP before 4.4.2 Server Crash via Item ID
Affected: from 4.0.0-BETA5, fixed in 4.4.2.
- CVE-2022-51009High 8.7
PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
Affected: fixed in 4.7.2.
- CVE-2021-48007High 7.1
PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
Affected: fixed in 3.18.1.
- CVE-2021-48006Medium 4.8
PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
Affected: fixed in 4.0.3.
- CVE-2020-37277High 7.1
PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction
Affected: fixed in 3.15.4.
- CVE-2023-7332High 7.1
PocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash
Affected: fixed in 4.18.1.